Trustpoint support & maintenance.
Defined expectations.

Professional Trustpoint support for industrial PKI operations.

When certificate issuance, renewal, revocation or documented Trustpoint workflows stop working as expected, technical teams need a clear route to diagnosis. Trustpoint Labs offers commercial break/fix support for customers operating official Trustpoint releases in production and business-critical environments under an active support agreement.

Commercial support follows a break/fix model. It does not include consulting, system design, integration projects, custom development, training or other professional services. These can be discussed separately through our industrial PKI engineering and integration services.

Support packages and coverage models define the service arrangement.

Trustpoint Labs support is available under distinct support packages, including Essential, Standard and Priority. These packages define the service profile and the expected handling priority for support requests in the context of an active agreement.

Coverage is then defined by the applicable support model. Serial Deployment Support applies where support is tied to a series, product line or repeated deployment model. Individual Deployment Support applies where support is scoped to a single deployment or defined installation.

The package level and the coverage model together determine how support is provided, what is covered and how service requests are handled. They do not change the underlying support scope for documented Trustpoint functionality or the separate engineering and integration services outside the support agreement.

All packages provide the same break/fix support scope; they differ in response targets and service level. Severity describes the operational impact, and the package sets the applicable initial-response target. Standard adds prioritized escalation and a quarterly support review. Priority adds highest-priority escalation during support hours, a monthly review and a named technical contact.

In short: severity tells us how urgent the fault is; the package determines the initial-response target and service level.

Technical troubleshooting for documented Trustpoint functionality.

Support covers technical problems affecting official Trustpoint releases where the software does not operate as documented or expected. Our support engineers assist with problem determination, troubleshooting and defect analysis related to Trustpoint itself.

Where appropriate, Trustpoint Labs may request that a customer update to a newer supported Trustpoint release before further troubleshooting. Support does not include the design, implementation or modification of customer environments.

What Trustpoint technical support covers.

Product functionality

Problems where Trustpoint does not behave according to its documentation or expected product functionality.

• Trustpoint services failing unexpectedly
• Certificate lifecycle operations not completing correctly
• Certificate issuance, renewal or revocation failures
• CA or RA functionality not behaving as documented
• Errors in Trustpoint workflows or the user interface
• Documented API functionality not operating correctly

Installation troubleshooting

Support includes troubleshooting installation problems where the customer has followed the official Trustpoint installation documentation. Support does not include performing a new installation or designing the deployment architecture.

Configuration troubleshooting

Support includes identifying errors within documented Trustpoint configuration options and determining whether a problem originates from Trustpoint or from the surrounding environment.

Updates and upgrades

Support includes troubleshooting problems occurring during or after an officially documented Trustpoint update or upgrade.

Protocols and interfaces

Support includes troubleshooting Trustpoint implementations of officially supported interfaces and protocols when they do not behave as documented. Depending on the Trustpoint release, this may include EST, CMP, REST APIs, OPC UA GDS functionality, and certificate or trust-store management interfaces.

Support covers the Trustpoint side of these interfaces. Configuration, implementation or troubleshooting of third-party systems is outside the standard support scope.

Defect reports

Reproducible defects in supported Trustpoint releases may be escalated to Trustpoint engineering. Where a software change is required, Trustpoint Labs may provide a workaround, recommend an update, or make a correction available through a future Trustpoint release.

Log and error analysis

Trustpoint Labs Support may analyze relevant Trustpoint logs, error messages and diagnostic information to identify the cause of a reported problem.

When professional PKI engineering is needed instead.

Installation and implementation services

• Performing a new Trustpoint installation
• Deploying Trustpoint into a customer environment
• Designing a production deployment
• Setting up operating systems, containers or infrastructure
• Configuring customer networks or firewalls

Architecture and design

• PKI architectures and certificate-management concepts
• OT security or network architectures
• Trust models
• Availability or disaster-recovery concepts

Integration projects

• Integration with third-party PKI products
• Configuration of external CAs
• Integration with customer applications or identity-management systems
• Integration with industrial devices or network infrastructure
• Creation of customer-specific deployment workflows

Support may assist in determining whether Trustpoint itself is functioning correctly at an integration boundary. Projects to integrate Trustpoint with third-party systems can be scoped separately through our Engineering & Integration services.

Third-party products and infrastructure

Trustpoint Labs does not provide standard support for third-party software, hardware or infrastructure, including operating systems, hypervisors, container platforms, unsupported databases, firewalls, switches, routers, HSM administration, external PKI products, OPC UA servers or clients, industrial controllers and other connected devices.

Device integration

• Device-specific onboarding implementations
• Custom certificate deployment mechanisms
• Device configuration
• Development of Web-UI Automation profiles
• Adaptation of Trustpoint to proprietary device interfaces

Custom development

• New Trustpoint features
• Custom software or scripts
• Customer-specific code, APIs or extensions
• Bespoke workflows

Modified versions and forks

Standard support does not cover third-party forks, modified Trustpoint source code, customer-specific builds, unreleased development branches or individual development commits unless separately agreed.

Consulting and training

• Consulting
• Security assessments or architecture workshops
• Penetration testing or compliance assessments
• Training
• Project engineering
• Performance optimization projects

Official Trustpoint releases from v1.0.0 onward.

Commercial Trustpoint Labs Support is available for official Trustpoint releases from version 1.0.0 onward. Support applies only to official releases published by the Trustpoint project.

Development branches, unofficial builds, forks and modified Trustpoint versions are outside the standard support scope unless explicitly included in a separate agreement.

All official Trustpoint releases from v1.0.0 onward remain eligible for standard break/fix support. Trustpoint Labs may recommend a newer release as a fix or workaround. Support for an older release does not imply a commitment to develop or backport fixes or security patches for that release.

Severity reflects technical and operational impact.

Customers may propose a severity level when submitting a support request. Trustpoint Labs may review and adjust the proposed severity based on the actual technical and operational impact and the definitions above. Any adjustment will be communicated to the customer. The original receipt time remains unchanged.

Initial response, not guaranteed resolution time.

Targets below are for a substantive initial response, not resolution. The response clock accumulates only during support hours. One business day equals 8 accumulated support hours; two business days equal 16. Requests received outside support hours start accruing response time at the beginning of the next support period.

An initial response must be a case-specific reply from Trustpoint Labs Support. An automated acknowledgement does not count as an initial response. Missing diagnostic information may delay troubleshooting but does not change the start of the response time.

Resolution time depends on factors including problem complexity, reproducibility, availability of diagnostic information, customer response times, required software changes and dependencies on third-party systems.

Business-hours support in Europe/Berlin.

Monday–Friday, 09:00–17:00 Europe/Berlin

Public holidays in Baden-Württemberg, Germany, are excluded. Response targets are measured only during these support hours. A case submitted outside support hours begins accruing response time at the start of the next support period.

Trustpoint Labs does not currently provide standard 24/7 support.

Send complete technical information from the start.

Customers with an active Trustpoint Labs support agreement can open a support case by email:

Please include

• Company name and technical contact
• Trustpoint version
• Deployment type and relevant environment information
• Requested severity
• Concise problem description
• Expected and actual behavior
• Business impact
• Relevant logs and error messages
• Steps to reproduce, where available
• Recent changes to the environment
• Known workaround, if any

Clear progress from submission to closure.

Support cases are tracked through Open, In Progress, Waiting for Customer, Resolved and Closed. A case may be placed in Waiting for Customer when additional information or action is required from the customer. This does not retrospectively change the initial response target.

A case may be considered resolved when a solution, reasonable workaround or final technical assessment has been provided. Cases may be closed following customer confirmation or after a reasonable period without further response. Closed cases may be reopened if the same issue recurs.

Effective support requires cooperation.

Customers are expected to:

• Provide a technically competent contact person
• Provide sufficient information to reproduce and diagnose the problem
• Provide relevant logs and error information
• Maintain appropriate backups and recovery procedures
• Apply recommended updates, patches or configuration changes where reasonably required
• Cooperate in determining whether the root cause lies within Trustpoint or the surrounding environment
• Respond to requests for additional diagnostic information
• Maintain the security of their systems and credentials

Remote access to customer systems is not included by default and must be separately agreed where required. The customer remains responsible for operating and administering its infrastructure.

Report suspected vulnerabilities privately.

Suspected security vulnerabilities in Trustpoint should not be submitted as normal support cases or published through public GitHub issues.

This includes suspected authentication or authorization bypasses, privilege escalation, unintended disclosure of sensitive information, cryptographic implementation weaknesses, or vulnerabilities affecting the confidentiality, integrity or availability of Trustpoint.

Please provide sufficient technical information to reproduce and evaluate the issue. Do not send private keys, passwords, production credentials or other sensitive information in unencrypted emails. Contact us first if a secure transfer method is required. Additional security contact information is available in our security.txt.

Industrial PKI integration, engineering and consulting beyond support.

Requests outside the standard support scope can be handled separately through Trustpoint Labs Professional Services. This may include deployment, industrial PKI architecture and consulting, integration engineering, device integration, custom automation, Web-UI Automation profiles, custom development, workshops and training.

Learn more about our Engineering & Integration servicesfor vendor-independent industrial PKI deployment and integration projects, or explore industrial PKI and machine identity use casesto see where certificate lifecycle management is applied.